Directory traversal in SD-SLS, SAP security note 1781994

SAP security note 1781994, “Directory traversal in SD-SLS”, is a program error note released on 13.08.2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Potential directory traversal in the following components:

• SD-SLS

Solution

For detailed information and instructions, refer to SAP Note 1497003. Ensure that the corrections from SAP Note 1497003 are applied before implementing this SAP Note.

Logical file names used in this solution:

• SD_ORDERS_FILE
• SD_ORDERS_FILE_ERR

File name paths used in this solution:

• SD_ORDERS_DATA_FILE_PATH
• SD_ORDERS_DATA_FILE_ERR_PATH

Recommendations for setting up logical file names: to minimize the number of logical file names and securely separate data created by different users and programs, create a directory structure that reflects the user or program name. Use this structure when setting up the physical path and file names for logical file paths and names.

Reason and prerequisites

The programs specified in the correction instructions contain vulnerabilities that allow an attacker to potentially read arbitrary files on the remote server, possibly disclosing confidential information. Additionally, some programs allow writing arbitrary files to the remote server, which could corrupt or alter system behavior.

References

• 1605703 – RSFILECR: Potential directory traversals in applications
• 1497003 – Potential directory traversals in applications

Affected components

• SAP_APPL 31I – 616